What is the CVSS score of EUVD-2026-58855?

EUVD-2026-58855 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Groundhogg CRM EUVD-2026-58855

| CVE-2026-18387 MEDIUM

SQL Injection (CWE-89)

2026-08-15 Wordfence

GHSA-4mgr-f3j8-4rg7

WordPress SQLi Wordpress Plugin Groundhogg Crm Newsletters And Marketing Automation Trainingbusinesspros

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable via API; PR:L reflects required authenticated vendor-level role; C:H for full DB read; I:N and A:N as no write or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 15, 2026 - 04:00 vuln.today

CVE Published

Aug 15, 2026 - 03:25 cve.org

MEDIUM 6.5

DescriptionCVE.org

The Groundhogg - CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tag_query' parameter in all versions up to, and including, 4.5.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the attacker to trigger the vulnerable Legacy_Contact_Query code path by submitting an unknown filter type (e.g. filters[0][0][type]=force_fallback), which causes a FilterException that dispatches execution away from the modern query handler.

AnalysisAI

SQL injection in the Groundhogg WordPress CRM plugin (versions through 4.5.14) permits authenticated attackers holding vendor-level or higher access to append arbitrary SQL to database queries via the insufficiently escaped 'tag_query' parameter, resulting in full read-access to the WordPress database. The exploitation path is non-trivial: the attacker must deliberately force execution into the deprecated Legacy_Contact_Query handler by submitting an unknown filter type that triggers a FilterException, bypassing the modern query handler's protections. No public exploit has been identified at time of analysis, and the vendor has issued a code fix (SVN changeset 3643654), though the exact patched release version is not independently confirmed in available data.

Technical ContextAI

The affected product is the Groundhogg - CRM, Newsletters, and Marketing Automation plugin for WordPress by trainingbusinesspros (CPE: cpe:2.3:a:trainingbusinesspros:groundhogg_-_crm,_newsletters,_and_marketing_automation). The root cause is CWE-89 (Improper Neutralization of Special Elements in SQL Commands): user-controlled input from the 'tag_query' parameter reaches SQL query construction in legacy-contact-query.php (line 548) and tag-query.php (lines 393, 415) without adequate parameterization or escaping. The plugin's v4 contacts API (contacts-api.php, line 230) dispatches filter processing through contact-query.php; when a modern handler raises a FilterException due to an unrecognized filter type, execution falls back to the Legacy_Contact_Query class, which lacks the prepared-statement protections of the modern handler. This architectural split between a hardened modern path and an unpatched legacy fallback is the structural enabler of the vulnerability.

RemediationAI

Apply the fix introduced in WordPress plugin SVN changeset 3643654 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3643654%40groundhogg&new=3643654%40groundhogg) by updating the Groundhogg plugin to the latest available version through the WordPress plugin repository; the exact post-4.5.14 release version number is not independently confirmed in the available advisory data, so verify the installed version exceeds 4.5.14 after updating. As an interim compensating control, restrict vendor-level role assignments to only fully trusted personnel and audit existing vendor accounts for unauthorized additions - reducing the eligible attacker pool is the highest-impact workaround since the vulnerability is gated behind that role. A WAF rule blocking requests to the contacts API endpoint that include filter parameters with unrecognized type values (e.g., 'force_fallback') or that include SQL metacharacters in the tag_query field can further reduce exposure, though this may incidentally block legitimate API clients using custom filter types. The read-only nature of the impact (I:N, A:N) means there is no risk of data destruction or denial of service while patching is in progress.